release: 1.0.0: Public 1.0 image; delivery log; docs and SECURITY.md (incl. 1.0.1)

[1.0.0]
Added:
  - A **Delivery log** on each delivery's page (`/deliveries/{id}`): the
  - A **History** block on the same page: the journal's two timestamps stated as
Fixed:
  - Postfix config: copy TLS cert/key from the (often `:ro`, host-owned) mount
  - Postfix config: allow `maillog_file` under `/data` via
  - E2e: read `/data/setup-token` via `docker compose exec` (file is `0600`
  - Entrypoint: check `SELFPOST_HOSTNAME` before `/data` setup (so a bad identity
  - E2e gate: wait for host-published `/healthz` before panel setup, and stop
  … (3 more in CHANGELOG)
Changed:
  - Document what `.spbk` and `.spde` stand for (SelfPost backup / SelfPost domain
  - Docs aligned with the code: setup URL is `/setup/<token>` (README and
  - Full backups no longer carry `/data/log`. It is Postfix's raw log plus its
  - Monitoring screens (status, mail queue, system log, deliveries) use adaptive
  - Documentation package consolidated into `docs/development.md`: Documentation
  … (4 more in CHANGELOG)
[1.0.1]
A documentation and packaging release: no change to the mail path, the database, or the on-disk layout. Upgrading is a tag bump.
Added:
  - `SECURITY.md` — how to report a vulnerability privately (GitHub private
  - [docs/plans/](docs/plans/) — one document per agreed extension: the optional
Changed:
  - The panel's **Account** entry is now called **Settings** — nav link, page
  - The signed-in name in the panel's nav is now labelled `User:`, so it reads as
  - [docs/product.md](docs/product.md) reframes the future line: the inbound
  - [docs/security.md](docs/security.md) is now in English, matching the rest of
  - The README documentation table now points at `SECURITY.md` for reporting a
  … (2 more in CHANGELOG)
Fixed:
  - The panel's static assets are served with a content ETag and

Squashed CHANGELOG sections: [1.0.0], [1.0.1].

Full detail: CHANGELOG.md (1.0.0, 1.0.1).

docs/plans/domain-admin.md

@@ -0,0 +1,72 @@
+# Plan: domain-admin (domain administrator role)
+
+**Status:** agreed  
+**Version:** target bump **1.x** MINOR, given a compatible migration of the
+current administrator into a global one.  
+**Order:** recommended after [web-split](web-split.md), before
+[inbound-relay](inbound-relay.md).
+
+---
+
+## What this is
+
+Today the panel has exactly one subject: `requireAuth` is a boolean gate, not a
+role ([web.go](../../internal/web/web.go) — the
+`mux.Handle("/", s.requireAuth(authed))` wrapper), and the session carries
+nothing beyond the fact of being signed in.
+
+The role grants access to **explicitly assigned domains** (one or several); the
+list of domains is set by the **global administrator**. For each domain on that
+list:
+
+- that domain's applications (creation, sender mode, password regeneration,
+  deletion, its own L2 limit);
+- the domain's DKIM/DNS status;
+- the send log filtered to the domain — the filter already exists in the log
+  ([sendLogData](../../internal/web/handlers_monitor.go)).
+
+What stays outside the role is what is global by nature:
+
+- adding and removing domains;
+- creating domain-admin users and assigning domains to them;
+- `/reload`;
+- the full backup (that is all of `/data` including `sasldb2`, i.e. every
+  domain at once);
+- the queue and the `mail.log` tail — those are server-wide and not tied to a
+  domain.
+
+## Why this extends v1.0
+
+[product.md](../product.md) puts "multiple panel users, roles" out of scope
+(one administrator). A second subject is a deliberate widening of the project's
+boundary, as inbound-relay is.
+
+The cost is phase-sized, not patch-sized:
+
+- a users table and their binding to domains;
+- the role in the session;
+- authorisation in every handler (not only on the route — today `{id}`/`{aid}`
+  are checked for nothing beyond existence);
+- reworking first-run setup and password change for several users;
+- accounting for the new subject in backup and domain export.
+
+*(The earlier wording of this item — "2FA and multiple administrators" — has
+been replaced: 2FA is off the table, and "multiple administrators" is narrowed
+to one specific role, because what is needed is not a second all-powerful admin
+but limited access for the owner of one or several domains, with the list set
+by the global administrator.)*
+
+## Done when
+
+- A global administrator and a domain-admin with different rights both work
+  through the panel; the domain-admin cannot reach past the **assigned**
+  domains;
+- the current single admin migrates into a global one without losing access;
+- backup/restore accounts for users and their bindings;
+- `build`/`vet`/`test`/image green.
+
+## Risks
+
+- An incomplete `{id}`/`{aid}` check in a handler — access leaking to someone
+  else's domain;
+- breaking setup or backup — that would be a semver major, not 1.x.